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Massive cryptocurrency heist spurs 
calls for more regulation 

Coincheck says it was hacked and will reimburse customers. 

Yuji Nakamura and Andrea Tan, Bloomberg / 29 January 2018 09:42 Qt One comment so far 
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The episode, disclosed by Coincheck executives at a hastily arranged press conference on Friday 
night, has heightened calls for stricter oversight at a time when many governments are grappling 
with how to regulate the booming cryptocurrency exchange industry. Japanese policymakers 
began a new licensing system for the venues just a few months ago, and regulators in South Korea 
are debating whether to ban exchanges outright. 

While Bitcoin and its ilk have recovered from their selloff on Friday — thanks in part to Coincheck's 
assurances over the weekend that customers would be partially reimbursed — market observers 
say concerns over security lapses at cryptocurrency exchanges are likely to persist. They may even 
push some investors toward peer-to-peer methods of trading that don't rely on centralised 
platforms. 

"The latest theft will have two immediate effects: more regulation by authorities over exchanges 
and more recognition of the advantages offered by decentralised ways of trading," said David 
Moskowitz, co-founder of Indorse Pte in Singapore, which runs a social network for blockchain 
enthusiasts. 

The U.S. Treasury described cryptocurrencies as an "evolving threat" earlier this month and said it's 
examining dealers to make sure they aren't being used to finance illegal activities. UK Prime 
Minister Theresa May has promised to consider a clampdown, while South Korean policy makers 
are debating whether to ban digital-asset exchanges outright. China outlawed the venues last year. 
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The heist adds to a long list of thefts at cryptocurrency exchanges and wallets, stretching back to 
the robbery of Tokyo-based Mt. Gox in 2014. As prices of digital assets have soared, the platforms 
have become increasingly juicy targets for hackers. A lack of confidence in exchanges — most of 
which operate with little to no regulation — has prompted many institutional investors to spurn 
cryptocurrencies, although some are now dipping into the market after CME Group and Cboe Global 
Markets introduced Bitcoin futures in the US last month. 
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"Such large scale hacks are some of the biggest risks faced today by the global crypto community," 
said Henri Arslanian, fintech and regtech lead at PwC in Hong Kong. 


More Than $1 Billion and Counting 

The biggest known thefts of digital currencies 
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Coincheck, one of Japan's biggest cryptocurrency exchanges, will use its own capital to reimburse 
customers who lost money in the theft, according to a statement posted on its website Sunday. 

The exchange — whose shareholders include 27-year-old chief executive officer Koichiro Wada, 
chief operating officer Yusuke Otsuka and two investment firms — said it has been in touch with 
the FSA and the Tokyo Metropolitan Police. 

According to Coincheck's account of the incident, an unidentified thief stole 523 million coins tied 
to the NEM blockchain project. The tokens were trading at about 94 US cents at the time of the 
hack. It wasn’t until around 11 am on Friday morning — about eight hours after the initial breach — 
that Coincheck staff noticed an alert pointing to a sharp drop in their NEM coin reserves. 

The thief was able to seize such a large sum in part because Coincheck lacked basic security 
protocols. It kept customer assets in what’s known as a hot wallet, which is connected to external 
networks. Exchanges generally try to keep a majority of customer deposits in cold wallets, which 
aren't connected to the outside world and thus are less vulnerable to hacks. 

Coincheck also lacked multi-signature, a security measure requiring multiple sign-offs before funds 
can be moved. While the safeguard failed to prevent a $65 million heist from Bitfinex in August 
2016, NEM's blockchain had multi-signature functions that experts say would have made the theft 
more difficult. 

The exchange hadn't implemented the security measures due to "the difficulty of the technology 
and a lack of staff able to carry out the task," Wada, who also serves as Coincheck’s chief 
technology officer, told a roomful of unusually combative reporters during a 90-minute press 
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conference at the Tokyo Stock Exchange headquarters that stretched into the early hours of 
Saturday morning. 

TV ads 

The theft sparked a social-media firestorm in Japan, one of the world's biggest cryptocurrency 
markets, and spurred angry customers to gather in the bitter cold outside Coincheck’s headquarters 
— just an eight-minute walk from the site where Mt. Gox imploded four years earlier. 

It was exactly the kind of scene that the country's financial regulator had been hoping to avoid when 
it introduced a licensing system for cryptocurrency exchanges last April. Coincheck was four 
months past its deadline for receiving such a license, but was allowed to continue operating — and 
advertising on television — while awaiting a final decision from the regulator. 

On Monday, the FSA ordered Coincheck to submit a report by Feb. 13 outlining the root causes of 
the debacle and its response to customers, along with how it intends to enhance risk management 
and internal controls. 

The exchange’s fate remains unclear. While Coincheck executives have said they plan to eventually 
restart trading, they hadn’t outlined a timeline by Monday morning. They did, however, pledge to 
compensate all 260 000 users impacted by the theft, at a rate of 88.549 yen (82 US cents) for each 
NEM coin. That’s sparked a rally in the tokens, which were trading at around 98 cents on Monday, 
according to Coinmarketcap.com. 

"A commitment by Coincheck to repay investors may at least partially explain the NEM price 
recovery, but can Coincheck actually deliver on that promise?" said Bert Ely, principal at financial 
consulting firm Ely & Co. in Virginia. "Time will tell." 

Coincheck said it was cooperating with other exchanges in the hope of tracing the missing tokens. 

"We know where the funds were sent," Otsuka, the Coincheck COO, said during the late-night press 
conference. "We are tracing them and if we're able to continue tracking, it may be possible to 
recover them." 

Regardless of how it plays out, the Coincheck theft is likely to push policymakers to enforce stricter 
security requirements at cryptocurrency exchanges, according to David Shin, a founding member of 
the Bitcoin Association of Hong Kong and president of the Singapore-based Asia Fintech Society. 

"A lot of regulators don’t know yet how to regulate this area,” Shin said. "This episode will definitely 
get their attention." 

© 2018 Bloomberg 
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